diff --git a/package.json b/package.json
index 16aa687..f8d7e0a 100644
--- a/package.json
+++ b/package.json
@@ -61,7 +61,7 @@
   },
   "build": {
     "appId": "im.riot.app",
-    "electronVersion": "8.0.1",
+    "electronVersion": "8.0.2",
     "files": [
       "package.json",
       {
@@ -102,6 +102,10 @@
     "directories": {
       "output": "dist"
     },
-    "afterSign": "scripts/electron_afterSign.js"
+    "afterSign": "scripts/electron_afterSign.js",
+    "protocols": [{
+      "name": "riot",
+      "schemes": ["riot"]
+    }]
   }
 }
diff --git a/scripts/in-docker.sh b/scripts/in-docker.sh
index 499a7b8..9758fc3 100755
--- a/scripts/in-docker.sh
+++ b/scripts/in-docker.sh
@@ -2,7 +2,7 @@
 
 docker inspect riot-desktop-dockerbuild 2> /dev/null > /dev/null
 if [ $? != 0 ]; then
-    echo "Docker image riot-desktop-builder not found. Have you run yarn run docker:setup?"
+    echo "Docker image riot-desktop-dockerbuild not found. Have you run yarn run docker:setup?"
     exit 1
 fi
 
diff --git a/src/electron-main.js b/src/electron-main.js
index 7350592..f518351 100644
--- a/src/electron-main.js
+++ b/src/electron-main.js
@@ -35,6 +35,7 @@ const tray = require('./tray');
 const vectorMenu = require('./vectormenu');
 const webContentsHandler = require('./webcontents-handler');
 const updater = require('./updater');
+const protocolInit = require('./protocol');
 
 const windowStateKeeper = require('electron-window-state');
 const Store = require('electron-store');
@@ -511,6 +512,9 @@ if (!gotLock) {
     app.exit();
 }
 
+// do this after we know we are the primary instance of the app
+protocolInit();
+
 // Register the scheme the app is served from as 'standard'
 // which allows things like relative URLs and IndexedDB to
 // work.
diff --git a/src/protocol.js b/src/protocol.js
new file mode 100644
index 0000000..153ff64
--- /dev/null
+++ b/src/protocol.js
@@ -0,0 +1,53 @@
+/*
+Copyright 2020 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+const {app} = require('electron');
+
+const processUrl = (url) => {
+    if (!global.mainWindow) return;
+    console.log("Handling link: ", url);
+    global.mainWindow.loadURL(url.replace("riot://", "vector://"));
+};
+
+module.exports = () => {
+    // get all args except `hidden` as it'd mean the app would not get focused
+    // XXX: passing args to protocol handlers only works on Windows,
+    // so unpackaged deep-linking and --profile passing won't work on Mac/Linux
+    const args = process.argv.slice(1).filter(arg => arg !== "--hidden" && arg !== "-hidden");
+    if (app.isPackaged) {
+        app.setAsDefaultProtocolClient('riot', process.execPath, args);
+    } else if (process.platform === 'win32') { // on Mac/Linux this would just cause the electron binary to open
+        // special handler for running without being packaged, e.g `electron .` by passing our app path to electron
+        app.setAsDefaultProtocolClient('riot', process.execPath, [app.getAppPath(), ...args]);
+    }
+
+    if (process.platform === 'darwin') {
+        // Protocol handler for macos
+        app.on('open-url', function(ev, url) {
+            ev.preventDefault();
+            processUrl(url);
+        });
+    } else {
+        // Protocol handler for win32/Linux
+        app.on('second-instance', (ev, commandLine) => {
+            const url = commandLine[commandLine.length - 1];
+            if (!url.startsWith("riot://")) return;
+            processUrl(url);
+        });
+    }
+};
+
+
diff --git a/src/webcontents-handler.js b/src/webcontents-handler.js
index a749e0a..8030646 100644
--- a/src/webcontents-handler.js
+++ b/src/webcontents-handler.js
@@ -198,19 +198,10 @@ function onEditableContextMenu(ev, params) {
 
 module.exports = (webContents) => {
     webContents.on('new-window', onWindowOrNavigate);
-    // XXX: The below now does absolutely nothing because of
-    // https://github.com/electron/electron/issues/8841
-    // Whilst this isn't a security issue since without
-    // node integration and with the sandbox, it should be
-    // no worse than opening the site in Chrome, it obviously
-    // means the user has to restart Riot to make it usable
-    // again (often unintuitive because it minimises to the
-    // system tray). We therefore need to be vigilant about
-    // putting target="_blank" on links in Riot (although
-    // we should generally be doing this anyway since links
-    // navigating you away from Riot in the browser is
-    // also annoying).
-    webContents.on('will-navigate', onWindowOrNavigate);
+    webContents.on('will-navigate', (ev, target) => {
+        if (target.startsWith("vector://")) return;
+        return onWindowOrNavigate(ev, target);
+    });
 
     webContents.on('context-menu', function(ev, params) {
         if (params.linkURL || params.srcURL) {